Splunk Search

How to format text extracted from a lookup?

ChrisCLewis
Communicator

Good afternoon,

I have text in a lookup.csv that has hard returns in it, for example:

This is the reason why the sun is hot:
reason 1.
reason 2.
reason 3.

But the result from the lookup turns the hard returns into spaces turning it into a single long sentence, for example:

This is the reason why the sun is hot: reason 1. reason 2. reason 3.

Is there a way to keep the hard returns (special characters in the CSV) or to put them in post lookup?

Many thanks for your time.

0 Karma

to4kawa
SplunkTrust
SplunkTrust
...
| append [|inputlookup lookup.csv]

and stats etc...

0 Karma

dsctm3
Path Finder

Is it possible your lookup is using Windows text format on a Splunk instance installed on *nix?

If so, consider using the dos2unix command on the lookup file. (You may need to install if from yum/apt)

0 Karma

ChrisCLewis
Communicator

The value of the lookup is being sent to a token if that makes things easier / more difficult

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!